Many-Time Pad (Multi-Message Keystream Reuse)
- •
What it is
- •
A generalization of the two-time pad to many (N) messages all encrypted under the same keystream. Since for any pair, crib-dragging a short guessed fragment into one ciphertext and XORing it against every other ciphertext simultaneously reveals the corresponding fragment of every other plaintext at that offset — letting you iteratively grow correctly-guessed cribs across the whole set of messages using natural-language plausibility as the check, rather than needing one fully-known plaintext up front.
- •
- •
When to apply
- •
A stream-cipher-mode oracle (CTR/OFB/etc.) re-encrypts messages under an identical effective keystream every time it's called — commonly because the counter, nonce, or IV resets to the same starting value on every request. Collect many ciphertexts, then crib-drag.
- •
- •
Math
- •
Same core identity as the two-time pad, applied pairwise across N ciphertexts: for every pair .
- •
- •
Worked example
- •
Starting from the flag-format crib
crypto{, XORing it against the ciphertext that produces all-printable output against every other ciphertext at that offset (identifying the flag's ciphertext) reveals a few readable characters in several other messages at the same offset — e.g. spottingunhappsuggests extending the crib toappy. XORing the longer crib in again extends every other message a few more characters. Repeating this — extend a plausible word, re-derive, repeat — incrementally decrypts the entire message set, flag included.
- •
- •
Python
- •
def bytewise_xor(a, b): n = min(len(a), len(b)) return bytes(a[i] ^ b[i] for i in range(n)) def extend_all(ciphertexts, known_idx, crib): return [bytewise_xor(crib, bytewise_xor(ct, ciphertexts[known_idx])) for ct in ciphertexts]
- •
- •
- •
Cards
- •
What server-side bug typically causes many-time-pad conditions in a CTF challenge?
- •
The stream cipher's counter/nonce/IV resets to the same starting value on every request, so every message reuses the identical keystream.
- •
- •
Why does crib-dragging work across many ciphertexts at once, not just two?
- •
Because holds for every pair sharing the keystream, so a correct crib against any one ciphertext simultaneously reveals a fragment of every other message.
- •
- •